bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8

General

Target

bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
Size

1.9MB
MD5

bab406ad3b0603a45625755ffbccce49
SHA1

7ce0bd31c68c5b54854098acad195b7a8d804939
SHA256

bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8
SHA512

a85ca2bc5ab42f8d32856a87c665b66df7d8e1c1ebbb143015d06fcc1bddba1faf684e2ee1d2a572f5ed04edf3a061837c293b5c1e3d2214864b90d8a68d25cc
SSDEEP

49152:hgWDef4IXn7EvfNf+x83OeG5ztpAEq2pe2n9SCtQV:hvo49fk83ONztiEqz2nA

Score

9^/10

persistence upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 43 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2204-5-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-6-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-8-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-9-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-10-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-11-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-16-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-17-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-18-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-34-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-39-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-45-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-49-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-50-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-51-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-53-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-55-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-60-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-66-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-70-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-77-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-82-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-88-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-93-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-99-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-95-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-92-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-91-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-89-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-85-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-81-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-79-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-78-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-76-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-74-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-73-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-68-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-67-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-64-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-63-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-61-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-58-0x0000000000400000-0x0000000000848000-memory.dmp	UPX
behavioral1/memory/2204-57-0x0000000000400000-0x0000000000848000-memory.dmp	UPX

UPX packed file 43 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2204-5-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-6-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-8-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-9-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-10-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-11-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-16-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-17-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-18-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-34-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-39-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-45-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-49-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-50-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-51-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-53-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-55-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-60-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-66-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-70-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-77-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-82-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-88-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-93-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-99-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-95-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-92-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-91-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-89-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-85-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-81-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-79-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-78-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-76-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-74-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-73-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-68-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-67-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-64-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-63-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-61-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-58-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2204-57-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

67 discord.com
83 discord.com
84 discord.com

flow	ioc
67	discord.com
83	discord.com
84	discord.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe

description	pid	process	target process
PID 2364 set thread context of 2204	2364	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe

pid	process
2204	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
2204	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
2204	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe

description	pid	process	target process
PID 2364 wrote to memory of 2204	2364	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
PID 2364 wrote to memory of 2204	2364	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
PID 2364 wrote to memory of 2204	2364	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
PID 2364 wrote to memory of 2204	2364	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
PID 2364 wrote to memory of 2204	2364	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
PID 2364 wrote to memory of 2204	2364	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
PID 2364 wrote to memory of 2204	2364	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
PID 2364 wrote to memory of 2204	2364	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
PID 2364 wrote to memory of 2204	2364	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe

C:\Users\Admin\AppData\Local\Temp\bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
"C:\Users\Admin\AppData\Local\Temp\bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2364

C:\Users\Admin\AppData\Local\Temp\bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
"C:\Users\Admin\AppData\Local\Temp\bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:2204

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp
Filesize
2.6MB

MD5
cf8ee7332b4e9b63aa7f40c9bc0aa208

SHA1
ad92e6a8a467887ac4776570f0fbc08814100017

SHA256
8634989b9b7b15d596feae1f681018fbfc31e96da1aebfc225fa62daf3712698

SHA512
3da1c498bc04b3bef7e8f08bc1dcdc309ec5437f13940b7c43e9c1b67c58389e1fc6d786de0eb9e77bb738823595c2af24e8b92650166efb5b9a508e85ea4483

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new
Filesize
6.4MB

MD5
226b01cdf38afa910fa5df42a4323d33

SHA1
86cb17ba65762420cf486a6f1c623144caead7bf

SHA256
3ef137a6b4b0a4dbb1fc10778414510a64ac802b8b9d96cf43b5f3145bdb10f1

SHA512
9a10e8f135c9da99088a6e5d0db9b3c8e77370d8110d615167a17174f4d06653d53c02906e4fb1216d4bbbb1b6e09110b7f010955659c64a7486718d958dbd3f

Download Submit
memory/2204-66-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-67-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-5-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-6-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-8-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-9-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-10-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-11-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-16-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-17-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-18-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-57-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2204-34-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-39-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-45-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-49-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-50-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-51-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-53-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-55-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-60-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-58-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-61-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-93-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-82-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-88-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-77-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-99-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-95-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-92-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-91-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-89-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-85-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-81-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-79-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-78-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-76-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-74-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-73-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-68-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-70-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-64-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2204-63-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2364-4-0x0000000002190000-0x0000000002347000-memory.dmp

Filesize
1.7MB

Download
memory/2364-0-0x0000000001FD0000-0x0000000002188000-memory.dmp

Filesize
1.7MB

Download
memory/2364-1-0x0000000001FD0000-0x0000000002188000-memory.dmp

Filesize
1.7MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads